[SCM] Samba Shared Repository - branch v4-0-test updated -
release-4-0-0alpha3-1907-g3038dd8
Andrew Bartlett
abartlet at samba.org
Wed May 28 03:43:42 GMT 2008
The branch, v4-0-test has been updated
via 3038dd8a4ffae4113f49547a9d4d6b1c8c46397a (commit)
via cb0dcd5c3dfe2a46755270a4594b7289f555d814 (commit)
via 56f2288e4f4f1aa70d11fc5f118458baf5803627 (commit)
via 0c15385e6068d2f70ff11aa5837adbd6d78410ae (commit)
from 7ae25aa6125e5375ac9c080a1e95fa34bda0dbe1 (commit)
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v4-0-test
- Log -----------------------------------------------------------------
commit 3038dd8a4ffae4113f49547a9d4d6b1c8c46397a
Merge: cb0dcd5c3dfe2a46755270a4594b7289f555d814 7ae25aa6125e5375ac9c080a1e95fa34bda0dbe1
Author: Andrew Bartlett <abartlet at samba.org>
Date: Wed May 28 13:42:29 2008 +1000
Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into 4-0-abartlet
commit cb0dcd5c3dfe2a46755270a4594b7289f555d814
Author: Andrew Bartlett <abartlet at samba.org>
Date: Wed May 28 13:21:26 2008 +1000
Bring up the ntp signing deamon
This starts ntp_signd at startup, and fixes some build issues.
Andrew Bartlett
commit 56f2288e4f4f1aa70d11fc5f118458baf5803627
Merge: 0c15385e6068d2f70ff11aa5837adbd6d78410ae 8c0b55114fe35d498626d9d60cc4716b821d4d4f
Author: Andrew Bartlett <abartlet at samba.org>
Date: Wed May 28 08:11:05 2008 +1000
Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into 4-0-abartlet
It seems the format of main.mk changed in my sleep...
Conflicts:
source/main.mk
commit 0c15385e6068d2f70ff11aa5837adbd6d78410ae
Author: Andrew Bartlett <abartlet at samba.org>
Date: Tue May 27 16:20:18 2008 +1000
Start an 'NTP signing server' in Samba4.
I am modifying the ntp.org server to talk to this service, to sign
packets per MS-SNTP.
Andrew Bartlett
-----------------------------------------------------------------------
Summary of changes:
source/Makefile | 1 +
source/librpc/config.mk | 7 +
source/librpc/idl/ntp_signd.idl | 30 +++++
source/main.mk | 1 +
source/ntp_signd/config.mk | 14 ++
source/ntp_signd/ntp_signd.c | 265 +++++++++++++++++++++++++++++++++++++++
source/param/loadparm.c | 2 +-
source/smbd/server.c | 1 +
8 files changed, 320 insertions(+), 1 deletions(-)
create mode 100644 source/librpc/idl/ntp_signd.idl
create mode 100644 source/ntp_signd/config.mk
create mode 100644 source/ntp_signd/ntp_signd.c
Changeset truncated at 500 lines:
diff --git a/source/Makefile b/source/Makefile
index 20a0876..14d0fe3 100644
--- a/source/Makefile
+++ b/source/Makefile
@@ -97,6 +97,7 @@ libclisrcdir := libcli
ejsscriptsrcdir := scripting/ejs
pyscriptsrcdir := $(srcdir)/scripting/python
kdcsrcdir := kdc
+ntp_signdsrcdir := ntp_signd
include data.mk
diff --git a/source/librpc/config.mk b/source/librpc/config.mk
index a39f504..a83308d 100644
--- a/source/librpc/config.mk
+++ b/source/librpc/config.mk
@@ -338,6 +338,13 @@ NDR_NBT_OBJ_FILES = $(gen_ndrsrcdir)/ndr_nbt.o
PUBLIC_HEADERS += $(gen_ndrsrcdir)/nbt.h
+[SUBSYSTEM::NDR_NTP_SIGND]
+PUBLIC_DEPENDENCIES = LIBNDR
+
+NDR_NTP_SIGND_OBJ_FILES = $(gen_ndrsrcdir)/ndr_ntp_signd.o
+
+PUBLIC_HEADERS += $(gen_ndrsrcdir)/ndr_ntp_signd.h
+
[SUBSYSTEM::NDR_WINSREPL]
PUBLIC_DEPENDENCIES = LIBNDR NDR_NBT
diff --git a/source/librpc/idl/ntp_signd.idl b/source/librpc/idl/ntp_signd.idl
new file mode 100644
index 0000000..d94a0a3
--- /dev/null
+++ b/source/librpc/idl/ntp_signd.idl
@@ -0,0 +1,30 @@
+/*
+ NTP signing IRPC interface
+*/
+
+#include "idl_types.h"
+
+[
+ uuid("0da00951-5b6c-4488-9a89-750cac70920c"),
+ version(1.0),
+ pointer_default(unique)
+]
+interface ntp_signd
+{
+
+ typedef [flag(NDR_BIG_ENDIAN),public] struct {
+ uint32 version;
+ uint32 op;
+ uint32 packet_id;
+ [flag(NDR_LITTLE_ENDIAN)] uint32 key_id;
+ [flag(NDR_REMAINING)] DATA_BLOB packet_to_sign;
+
+ } sign_request;
+
+ typedef [flag(NDR_BIG_ENDIAN),public] struct samba_key_out {
+ uint32 version;
+ uint32 op;
+ uint32 packet_id;
+ [flag(NDR_REMAINING)] DATA_BLOB signed_packet;
+ } signed_reply;
+}
\ No newline at end of file
diff --git a/source/main.mk b/source/main.mk
index 4fd1502..3f3aea8 100644
--- a/source/main.mk
+++ b/source/main.mk
@@ -36,6 +36,7 @@ mkinclude winbind/config.mk
mkinclude nbt_server/config.mk
mkinclude wrepl_server/config.mk
mkinclude cldap_server/config.mk
+mkinclude ntp_signd/config.mk
mkinclude utils/net/config.mk
mkinclude utils/config.mk
mkinclude ntvfs/config.mk
diff --git a/source/ntp_signd/config.mk b/source/ntp_signd/config.mk
new file mode 100644
index 0000000..96e0de5
--- /dev/null
+++ b/source/ntp_signd/config.mk
@@ -0,0 +1,14 @@
+# NTP_SIGND server subsystem
+
+#######################
+# Start SUBSYSTEM NTP_signd
+[MODULE::NTP_SIGND]
+INIT_FUNCTION = server_service_ntp_signd_init
+SUBSYSTEM = smbd
+PRIVATE_DEPENDENCIES = \
+ SAMDB NDR_NTP_SIGND
+# End SUBSYSTEM NTP_SIGND
+#######################
+
+NTP_SIGND_OBJ_FILES = $(addprefix $(ntp_signdsrcdir)/, ntp_signd.o)
+
diff --git a/source/ntp_signd/ntp_signd.c b/source/ntp_signd/ntp_signd.c
new file mode 100644
index 0000000..35016d5
--- /dev/null
+++ b/source/ntp_signd/ntp_signd.c
@@ -0,0 +1,265 @@
+/*
+ Unix SMB/CIFS implementation.
+
+ NTP packet signing server
+
+ Copyright (C) Andrew Bartlett <abartlet at samba.org> 2005
+ Copyright (C) Andrew Tridgell 2005
+ Copyright (C) Stefan Metzmacher 2005
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "smbd/service_task.h"
+#include "smbd/service.h"
+#include "smbd/service_stream.h"
+#include "smbd/process_model.h"
+#include "lib/stream/packet.h"
+#include "librpc/gen_ndr/ndr_ntp_signd.h"
+#include "param/param.h"
+#include "dsdb/samdb/samdb.h"
+#include "auth/auth.h"
+#include "libcli/security/security.h"
+#include "lib/ldb/include/ldb.h"
+#include "lib/ldb/include/ldb_errors.h"
+
+/*
+ top level context structure for the ntp_signd server
+*/
+struct ntp_signd_server {
+ struct task_server *task;
+ struct ldb_context *samdb;
+};
+
+/*
+ state of an open connection
+*/
+struct ntp_signd_connection {
+ /* stream connection we belong to */
+ struct stream_connection *conn;
+
+ /* the ntp_signd_server the connection belongs to */
+ struct ntp_signd_server *ntp_signd;
+
+ struct packet_context *packet;
+};
+
+static void ntp_signd_terminate_connection(struct ntp_signd_connection *ntp_signdconn, const char *reason)
+{
+ stream_terminate_connection(ntp_signdconn->conn, reason);
+}
+
+/*
+ receive a full packet on a NTP_SIGND connection
+*/
+static NTSTATUS ntp_signd_recv(void *private, DATA_BLOB blob)
+{
+ struct ntp_signd_connection *ntp_signdconn = talloc_get_type(private,
+ struct ntp_signd_connection);
+ NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
+ TALLOC_CTX *tmp_ctx = talloc_new(ntp_signdconn);
+ DATA_BLOB input, reply;
+ const struct dom_sid *domain_sid;
+ struct dom_sid *sid;
+ struct sign_request sign_request;
+ enum ndr_err_code ndr_err;
+ struct ldb_result *res;
+ const char *attrs[] = { "unicodePwd", NULL };
+ int ret;
+
+ talloc_steal(tmp_ctx, blob.data);
+
+ input = data_blob_const(blob.data + 4, blob.length - 4);
+
+ ndr_err = ndr_pull_struct_blob_all(&input, tmp_ctx,
+ lp_iconv_convenience(ntp_signdconn->ntp_signd->task->lp_ctx),
+ &sign_request,
+ (ndr_pull_flags_fn_t)ndr_pull_sign_request);
+
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ DEBUG(1,("failed to parse ntp signing request\n"));
+ dump_data(1, input.data, input.length);
+ return ndr_map_error2ntstatus(ndr_err);
+ }
+
+ domain_sid = samdb_domain_sid(ntp_signdconn->ntp_signd->samdb);
+ if (!domain_sid) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ sid = dom_sid_add_rid(tmp_ctx, domain_sid, sign_request.key_id & 0x7FFFFFFF);
+ if (!sid) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ /* Sign packet */
+ ret = ldb_search_exp_fmt(ntp_signdconn->ntp_signd->samdb, tmp_ctx,
+ &res, samdb_base_dn(ntp_signdconn->ntp_signd->samdb),
+ LDB_SCOPE_SUBTREE, attrs, "(&(objectSid=%s)(objectClass=computer))",
+ dom_sid_string(tmp_ctx, sid));
+ if (ret != LDB_SUCCESS) {
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ if (res->count != 1) {
+ return NT_STATUS_NO_SUCH_USER;
+ }
+
+ /* Sign the NTP response with the unicodePwd */
+
+ /* Place it into the packet for the wire */
+
+ blob = data_blob_talloc(ntp_signdconn, NULL, reply.length + 4);
+ if (!blob.data) {
+ talloc_free(tmp_ctx);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ RSIVAL(blob.data, 0, reply.length);
+ memcpy(blob.data + 4, reply.data, reply.length);
+
+ status = packet_send(ntp_signdconn->packet, blob);
+
+ /* the call isn't needed any more */
+ talloc_free(tmp_ctx);
+ return status;
+}
+
+/*
+ receive some data on a NTP_SIGND connection
+*/
+static void ntp_signd_recv_handler(struct stream_connection *conn, uint16_t flags)
+{
+ struct ntp_signd_connection *ntp_signdconn = talloc_get_type(conn->private,
+ struct ntp_signd_connection);
+ packet_recv(ntp_signdconn->packet);
+}
+
+/*
+ called on a tcp recv error
+*/
+static void ntp_signd_recv_error(void *private, NTSTATUS status)
+{
+ struct ntp_signd_connection *ntp_signdconn = talloc_get_type(private, struct ntp_signd_connection);
+ ntp_signd_terminate_connection(ntp_signdconn, nt_errstr(status));
+}
+
+/*
+ called when we can write to a connection
+*/
+static void ntp_signd_send(struct stream_connection *conn, uint16_t flags)
+{
+ struct ntp_signd_connection *ntp_signdconn = talloc_get_type(conn->private,
+ struct ntp_signd_connection);
+ packet_queue_run(ntp_signdconn->packet);
+}
+
+/*
+ called when we get a new connection
+*/
+static void ntp_signd_accept(struct stream_connection *conn)
+{
+ struct ntp_signd_server *ntp_signd = talloc_get_type(conn->private, struct ntp_signd_server);
+ struct ntp_signd_connection *ntp_signdconn;
+
+ ntp_signdconn = talloc_zero(conn, struct ntp_signd_connection);
+ if (!ntp_signdconn) {
+ stream_terminate_connection(conn, "ntp_signd_accept: out of memory");
+ return;
+ }
+ ntp_signdconn->conn = conn;
+ ntp_signdconn->ntp_signd = ntp_signd;
+ conn->private = ntp_signdconn;
+
+ ntp_signdconn->packet = packet_init(ntp_signdconn);
+ if (ntp_signdconn->packet == NULL) {
+ ntp_signd_terminate_connection(ntp_signdconn, "ntp_signd_accept: out of memory");
+ return;
+ }
+ packet_set_private(ntp_signdconn->packet, ntp_signdconn);
+ packet_set_socket(ntp_signdconn->packet, conn->socket);
+ packet_set_callback(ntp_signdconn->packet, ntp_signd_recv);
+ packet_set_full_request(ntp_signdconn->packet, packet_full_request_u32);
+ packet_set_error_handler(ntp_signdconn->packet, ntp_signd_recv_error);
+ packet_set_event_context(ntp_signdconn->packet, conn->event.ctx);
+ packet_set_fde(ntp_signdconn->packet, conn->event.fde);
+ packet_set_serialise(ntp_signdconn->packet);
+}
+
+static const struct stream_server_ops ntp_signd_stream_ops = {
+ .name = "ntp_signd",
+ .accept_connection = ntp_signd_accept,
+ .recv_handler = ntp_signd_recv_handler,
+ .send_handler = ntp_signd_send
+};
+
+/*
+ startup the ntp_signd task
+*/
+static void ntp_signd_task_init(struct task_server *task)
+{
+ struct ntp_signd_server *ntp_signd;
+ NTSTATUS status;
+
+ const struct model_ops *model_ops;
+
+ const char *address = "/tmp/ux_demo";
+
+ /* within the ntp_signd task we want to be a single process, so
+ ask for the single process model ops and pass these to the
+ stream_setup_socket() call. */
+ model_ops = process_model_byname("single");
+ if (!model_ops) {
+ DEBUG(0,("Can't find 'single' process model_ops\n"));
+ return;
+ }
+
+ task_server_set_title(task, "task[ntp_signd]");
+
+ ntp_signd = talloc(task, struct ntp_signd_server);
+ if (ntp_signd == NULL) {
+ task_server_terminate(task, "ntp_signd: out of memory");
+ return;
+ }
+
+ ntp_signd->task = task;
+
+ ntp_signd->samdb = samdb_connect(ntp_signd, task->event_ctx, task->lp_ctx, anonymous_session(ntp_signd, task->event_ctx, task->lp_ctx));
+ if (ntp_signd->samdb == NULL) {
+ task_server_terminate(task, "ntp_signd failed to open samdb");
+ return;
+ }
+
+ status = stream_setup_socket(ntp_signd->task->event_ctx,
+ ntp_signd->task->lp_ctx,
+ model_ops,
+ &ntp_signd_stream_ops,
+ "unix", address, NULL,
+ lp_socket_options(ntp_signd->task->lp_ctx),
+ ntp_signd);
+ if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(0,("Failed to bind to %s - %s\n",
+ address, nt_errstr(status)));
+ return;
+ }
+
+}
+
+
+/* called at smbd startup - register ourselves as a server service */
+NTSTATUS server_service_ntp_signd_init(void)
+{
+ return register_server_service("ntp_signd", ntp_signd_task_init);
+}
diff --git a/source/param/loadparm.c b/source/param/loadparm.c
index b70e4c1..ad1752a 100644
--- a/source/param/loadparm.c
+++ b/source/param/loadparm.c
@@ -2296,7 +2296,7 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx)
lp_do_global_parameter(lp_ctx, "max connections", "-1");
lp_do_global_parameter(lp_ctx, "dcerpc endpoint servers", "epmapper srvsvc wkssvc rpcecho samr netlogon lsarpc spoolss drsuapi winreg dssetup unixinfo");
- lp_do_global_parameter(lp_ctx, "server services", "smb rpc nbt wrepl ldap cldap kdc drepl winbind");
+ lp_do_global_parameter(lp_ctx, "server services", "smb rpc nbt wrepl ldap cldap kdc drepl winbind ntp_signd");
lp_do_global_parameter(lp_ctx, "ntptr providor", "simple_ldb");
lp_do_global_parameter(lp_ctx, "auth methods:domain controller", "anonymous sam_ignoredomain");
lp_do_global_parameter(lp_ctx, "auth methods:member server", "anonymous sam winbind");
diff --git a/source/smbd/server.c b/source/smbd/server.c
index e1ebd13..c1c8b63 100644
--- a/source/smbd/server.c
+++ b/source/smbd/server.c
@@ -198,6 +198,7 @@ static int binary_smbd_main(const char *binary_name, int argc, const char *argv[
extern NTSTATUS server_service_smb_init(void);
extern NTSTATUS server_service_drepl_init(void);
extern NTSTATUS server_service_rpc_init(void);
+ extern NTSTATUS server_service_ntp_signd_init(void);
init_module_fn static_init[] = { STATIC_smbd_MODULES };
init_module_fn *shared_init;
struct event_context *event_ctx;
--
Samba Shared Repository
More information about the samba-cvs
mailing list